Balancing test

The balancing test sits at the heart of the legitimate interests legal basis under Art. 6(1)(f) GDPR. It applies where a processing operation cannot be based on consent, a contract or a legal obligation, yet the controller still pursues a legitimate processing purpose. Unlike other legal bases, lawfulness here is not laid down in the abstract; it must be established and documented case by case through an evaluative comparison of the competing interests at stake.

The assessment runs in three steps. The first step determines whether a legitimate interest of the controller or a third party exists at all; this may be economic, legal, ethical or organisational, such as fraud prevention, network and information security or direct marketing. The second step (necessity) examines whether the specific processing is suitable and necessary to achieve that interest and whether no less intrusive, equally effective means is available. The third step is the actual balancing exercise: the legitimate interests must not be overridden by the interests or the fundamental rights and freedoms of the data subject.

Decisive for the third step are, in particular, the reasonable expectations of the data subject, the nature of the data processed, the processing context and any safeguards such as pseudonymisation, access restrictions or transparency. A stricter standard applies to children and to special categories of personal data. Because of the accountability principle in Art. 5(2) GDPR, the outcome should be recorded in writing in a so-called Legitimate Interests Assessment (LIA), since the data subject has a right to object under Art. 21 GDPR and the supervisory authority must be able to retrace the balancing exercise at any time.